show dmvpn issue

[ccg-security]

Hi Cisco Support,

May we request for your assistance as we are having an issue on "show dmvpn" as tunnel state are "ike". Is this a behavior of dmvpn? We have 4 tunnels, 1 is "UP" and 3 is"IKE". tunnel ips are reachable on Spoke router side to HUB.

Software Version is 15.2(4)M6a C2900 Router

Thanks!

[Francesco Molino · Accepted solution]

Hi

Ike state means that your crypto hasn't been negotiated between peers.

You're pinging the wan IP used by the tunnel interface to come up but not the tunnel IP itself. 

can you share the output of show cry isak sa and show cry ipsec sa?

Have you run some debug crypto to see why you're stuck in Ike state? 

Are you using certificates or preshared key for ipsec? Validated that the key or certificates are correct. 

[ccg-security]

Hi Francesco,

We are requesting for a "debug dmvpn detail crypto tunnel" to know where it stops and also if they can ping the tunnel ip instead the NBMA address.

Thanks!

[ccg-security]

Hi Francesco,

the resolution is to delete and import again the certificate. What could be the know issue for this case?

Thanks!

[Francesco Molino]

Hi

did you checked your certificate were still valid? Have you done the debug? With these outputs, you'll be able to see where the issue was.

[ccg-security]

Hi,
We didn't get any of the debugs and yes the certificates are still valid. I've ordered the client to get the debugs if the issue re occur.
Thanks!

[Francesco Molino]

You're welcome. without debugs and clear output we can't do nothing.
Anyway, happy that reinstalling the certificate solved your issue